CVE-2026-40066 Anviz Products Download of Code Without Integrity Check
Attackers can upload unverified update packages to Anviz CX2 Lite and CX7 devices to achieve unauthenticated remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40066?
CVE-2026-40066 is a high-severity code injection vulnerability in Anviz CX2 Lite Firmware, published on 17 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
Weakness: CWE-494
Which versions are affected by CVE-2026-40066?
It affects 2 products.
Products include Anviz Cx2 Lite Firmware, Anviz Cx7 Firmware.
How do I fix CVE-2026-40066?
No fix has been published for CVE-2026-40066 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-40066 being exploited?
There is no known exploitation of CVE-2026-40066 in the wild and no public exploit code.
Other vulnerabilities in Anviz CX2 Lite Firmware
- CVE-2026-35546 Anviz Products Missing Authentication for Critical Function
- CVE-2026-35682 Anviz CX2 Lite Command Injection
- CVE-2026-40461 Anviz Products Missing Authentication for Critical Function
- CVE-2026-33569 Anviz Products Cleartext Transmission of Sensitive Information
- CVE-2026-32648 Anviz Products Missing Authorization
Sources
Also known as GHSA-wh3w-c78x-9663.